PUBLISHED
2026-07-24 13:18
MODIFIED
2026-07-24 13:18
EPSS (Prob. Exploit)
0.53%
Top 56.1%
> DESCRIPTION
Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service.
Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read.
This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-191: Integer Underflow (Wrap or Wraparound) - The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. | CWE-787: Out-of-bounds Write - The product writes data past the end, or before the beginning, of the intended buffer.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache NimBLE: Incorrect data validation in BASS add/modify source operation
AFFECTED PACKAGES:
Unknown / Unknown
10 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
24/07/2026 13:18
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-191: Integer Underflow (Wrap or Wraparound) - The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is no...
Total des modifications: 1
Dernière mise à jour: 3 months ago